deleted file mode 100644

@@ -1,34 +0,0 @@

-diff -ru openssl-1.0.2h/crypto/bn/bn_print.c openssl-1.0.2h-modified/crypto/bn/bn_print.c

-+++ openssl-1.0.2h-modified/crypto/bn/bn_print.c	2016-09-20 15:41:13.789132068 -0700

-@@ -111,6 +111,7 @@

-     char *p;

-     BIGNUM *t = NULL;

-     BN_ULONG *bn_data = NULL, *lp;

-+    int bn_data_num;

- 

-     /*-

-      * get an upper bound for the length of the decimal integer

-@@ -120,8 +121,8 @@

-      */

-     i = BN_num_bits(a) * 3;

-     num = (i / 10 + i / 1000 + 1) + 1;

--    bn_data =

--        (BN_ULONG *)OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

-+    bn_data_num = num / BN_DEC_NUM + 1;

-+    bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));

-     buf = (char *)OPENSSL_malloc(num + 3);

-     if ((buf == NULL) || (bn_data == NULL)) {

-         BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);

-@@ -143,7 +144,11 @@

-         i = 0;

-         while (!BN_is_zero(t)) {

-             *lp = BN_div_word(t, BN_DEC_CONV);

-+            if (*lp == (BN_ULONG)-1)

-+                goto err;

-             lp++;

-+            if (lp - bn_data >= bn_data_num)

-+                goto err;

-         }

-         lp--;

-         /*

deleted file mode 100644

@@ -1,28 +0,0 @@

-From 2b4029e68fd7002d2307e6c3cde0f3784eef9c83 Mon Sep 17 00:00:00 2001

-From: "Dr. Stephen Henson" <steve@openssl.org>

-Date: Fri, 19 Aug 2016 23:28:29 +0100

-Subject: [PATCH] Avoid overflow in MDC2_Update()

-

-Thanks to Shi Lei for reporting this issue.

-

-CVE-2016-6303

-

-Reviewed-by: Matt Caswell <matt@openssl.org>

-(cherry picked from commit 55d83bf7c10c7b205fffa23fa7c3977491e56c07)

- crypto/mdc2/mdc2dgst.c | 2 +-

- 1 file changed, 1 insertion(+), 1 deletion(-)

-

-diff --git a/crypto/mdc2/mdc2dgst.c b/crypto/mdc2/mdc2dgst.c

-index 6615cf8..2dce493 100644

-+++ b/crypto/mdc2/mdc2dgst.c

-@@ -91,7 +91,7 @@ int MDC2_Update(MDC2_CTX *c, const unsigned char *in, size_t len)

- 

-     i = c->num;

-     if (i != 0) {

--        if (i + len < MDC2_BLOCK) {

-+        if (len < MDC2_BLOCK - i) {

-             /* partial block */

-             memcpy(&(c->data[i]), in, len);

-             c->num += (int)len;

new file mode 100644

@@ -0,0 +1,36 @@

+From 31c8b265591a0aaa462a1f3eb5770661aaac67db Mon Sep 17 00:00:00 2001

+From: Rich Salz <rsalz@openssl.org>

+Date: Tue, 22 Aug 2017 11:44:41 -0400

+Subject: [PATCH] Avoid out-of-bounds read

+

+Fixes CVE 2017-3735

+

+Reviewed-by: Kurt Roeckx <kurt@roeckx.be>

+(Merged from https://github.com/openssl/openssl/pull/4276)

+

+(cherry picked from commit b23171744b01e473ebbfd6edad70c1c3825ffbcd)

+---

+ crypto/x509v3/v3_addr.c | 10 ++++++----

+ 1 file changed, 6 insertions(+), 4 deletions(-)

+

+diff --git a/crypto/x509v3/v3_addr.c b/crypto/x509v3/v3_addr.c

+index 1290dec9bb8..af080a04f2b 100644

+--- a/crypto/x509v3/v3_addr.c

+@@ -130,10 +130,12 @@ static int length_from_afi(const unsigned afi)

+  */

+ unsigned int v3_addr_get_afi(const IPAddressFamily *f)

+ {

+-    return ((f != NULL &&

+-             f->addressFamily != NULL && f->addressFamily->data != NULL)

+-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))

+-            : 0);

++    if (f == NULL

++            || f->addressFamily == NULL

++            || f->addressFamily->data == NULL

++            || f->addressFamily->length < 2)

++        return 0;

++    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];

+ }

+ 

+ /*

@@ -1,7 +1,7 @@

 Summary:        Management tools and libraries relating to cryptography

 Name:           openssl

 Version:        1.0.2l

-Release:        1%{?dist}

+Release:        2%{?dist}

 License:        OpenSSL

 URL:            http://www.openssl.org

 Group:          System Environment/Security

@@ -13,6 +13,7 @@ Patch0:         c_rehash.patch

 Patch1:         openssl-1.0.2f-ipv6apps.patch

 Patch2:         openssl-init-conslidate.patch

 Patch3:         openssl-drbg-default-read-system-fips.patch

+Patch4:         openssl-CVE-2017-3735.patch

 %if %{with_check}

 BuildRequires: zlib-devel

 %endif

@@ -56,6 +57,7 @@ Perl scripts that convert certificates and keys to various formats.

 %patch1 -p1

 %patch2 -p1

 %patch3 -p1

+%patch4 -p1

 %build

 export CFLAGS="%{optflags}"

@@ -115,6 +117,8 @@ rm -rf %{buildroot}/*

 /%{_bindir}/c_rehash

 %changelog

+*   Tue Oct 10 2017 Vinay Kulkarni <kulkarniv@vmware.com> 1.0.2l-2

+-   Fix CVE-2017-3735 OOB read.

 *   Fri Aug 11 2017 Anish Swaminathan <anishs@vmware.com> 1.0.2l-1

 -   Upgrade to 1.0.2l

 *   Thu Aug 10 2017 Chang Lee <changlee@vmware.com> 1.0.2k-4